can you get the "stat" output for that file? Monit tests the mtime (content modification time) and ctime (inode modification time - owner, permission, etc.), the event is generated if one of them changed. The "ls" won't display ctime by default, to display the ctime with ls, you can use: "ls -lc"